feat: add PADE module

[ksteffe]

Description

PADE provides a portable development-session capability intent/consumer model. It resolves explicitly configured capabilities through a broker using runtime workload identity rather than placing durable provider authority directly in a workspace.

This ports the existing PADE Coder module into the community after-certainty namespace. It installs the released CLI with SHA256SUMS verification and writes explicit broker-backed bindings, using coder-utils 0.0.2 for orchestration. Public inputs, outputs, installation paths, and compatibility claims are preserved.

Coder owns workspace lifecycle. The underlying runtime supplies workload identity. PADE consumes that identity and mediates authorized capabilities. The module does not reinterpret Coder control-plane credentials as PADE workload identity; PADE is not a complete agent security solution.

End-to-end dogfood evidence covers a GCE-backed Linux amd64 Coder workspace, PADE v0.3.0, and github.repo.read against a deployed broker. Cursor identity, Linux arm64, other releases, and other authorized capability names remain accepted but unproven through this integration.

This contribution does not add or modify PADE protocol behavior, broker behavior, or identity implementations. The original Routed P icon is preserved; the namespace uses a project-derived AC placeholder avatar that can be replaced with an organization avatar later.

Type of Change

• New module

Module Information

Path: registry/after-certainty/modules/pade
New version: v1.0.0
Breaking change: No

Testing & Validation

• Code formatted (bun run fmt, bun run fmt:ci, terraform fmt -check -recursive -diff)
• README/frontmatter, namespace, and relative asset validation (go run ./cmd/readmevalidation)
• ShellCheck installer and repository set -u ordering validation
• Terraform validation/tests and Bun installer tests pass in fork CI

Tests use the Registry's native ~test helpers and deterministic release fixtures; no production broker, real workload identity, GitHub credentials, or live PADE release downloads are needed. Coverage includes input validation, exact bindings, stable outputs, coder-utils orchestration, architectures, checksums, permissions, shell startup, idempotency, and credential boundaries.

Local runtime checks were blocked by the execution environment's Terraform socket and Docker restrictions. They subsequently passed using the unmodified Registry workflows in the fork on commit 8a5961a:

• CI: passed — Bun installer tests, Terraform tests/validation, formatting, typos, README/namespace validation, and shell checks.
• Go lint: passed.
• Module scorecard: could not run — the fork lacks Coder's SCORECARD_CDRSTABLE_TOKEN secret (SCORECARD_CODER_TOKEN not set). No score was produced; maintainers can run the scorecard upstream.

No upstream validation was disabled or weakened. The fork-only validation PR is closed without merging; its results remain available.

Related Issues

None.

---

AI-assisted with OpenAI Codex using GPT-6.